Comment 20 for bug 1025852

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

I can confirm this. When running as root, the following denial is seen on 12.10:
Sep 25 11:13:12 sec-quantal-amd64 kernel: [ 3266.683520] type=1400 audit(1348589592.491:27): apparmor="DENIED" operation="file_mmap" parent=3456 profile="/usr/lib/telepathy/telepathy-*" name="/usr/lib/telepathy/gabble-0/lib/libgabble-plugins-0.16.1.so" pid=3457 comm="telepathy-gabbl" requested_mask="m" denied_mask="m" fsuid=0 ouid=0

This is because of the following rule in the /usr/lib/telepathy/telepathy-* profile:
audit deny owner /** m,

Root owns /usr/lib/telepathy/gabble-0/lib/libgabble-plugins-0.16.1.so so AppArmor denies the access. Due to current limitations in AppArmor, this rule must be present to guard against arbitrary code execution via environment variables and unfortunately we cannot remove this rule in Ubuntu. This only affects users who enable the root account (it is disabled by default) and run the desktop as root (generally a bad idea).

Marking "Won't Fix".

WORKAROUND: Because the profile is not designed to confine the root user, you should either use empathy as non-root (highly recommended) or disable the profile with 'sudo apt-get install apparmor-utils ; sudo aa-disable /etc/apparmor.d/usr.lib.telepathy'